A city application sits behind a CDN that hides origin addresses, and the RoE allows origin discovery if it stays non-disruptive. Which recon approach best matches that goal?
Select an answer to reveal the explanation.
Short Explanation
A CDN is a fancy storefront; the warehouse address sometimes still shows up in old maps and DNS history. Dig those public breadcrumbs instead of knocking the storefront over.
Full Explanation
When a city application sits behind a CDN that hides origin addresses and RoE allows non-disruptive origin discovery, reviewing historical DNS and related public records for origin leaks that bypass the CDN front best matches the goal. Volumetric traffic against the CDN edge to force origin IPs into error pages is disruptive and inappropriate. Assuming the CDN permanently eliminates all origin exposure is overly optimistic and skips research. Asking the CDN vendor to delete the city zone is not a recon technique and may harm production. Exam caveat: if an origin IP is found, confirm it is in scope before probing and avoid DoS. Operational check: check historical DNS, TLS artifacts, and related public records; validate candidate origins gently; report exposure and recommend locking origin access to CDN networks only. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.